Scientific Linux Security Update : openssl on SL5.x i386/x86_64
Medium Nessus Plugin ID 74487
SynopsisThe remote Scientific Linux host is missing one or more security updates.
DescriptionIt was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server.
Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL. For more information about this flaw, refer to :
For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted.
SolutionUpdate the affected packages.